Hyperion Financial Reporting CVE-2026-70780

Exploitation requires that the attacker be physically or logically adjacent to the network segment on which the Oracle Hyperion Financial Reporting server operates - this is a hard constraint from AV:A and explicitly stated in the description as 'access to the physical communication segment attached to the hardware.' Additionally, AC:H indicates that exploitation is not straightforward and requires meeting specific technical conditions, likely related to protocol-level interaction timing or message construction. PR:N confirms that no credentials or authentication tokens are required once network adjacency is achieved. What limits exploitation: the attacker cannot operate from a remote internet position; they must be on the same broadcast domain or physical network link. High attack complexity further reduces the likelihood of opportunistic exploitation. The vulnerability does not require any victim user interaction (UI:N). There is no indication that a non-default configuration is required - any deployment of version 11.2.25.0.000 on an accessible network segment appears to be in scope.

The CVSS 3.1 score of 6.8 is an accurate representation of realistic exploitability: while the confidentiality and integrity impacts are both rated High - meaning a successful attacker gains full access to all financial data - the adjacent-network (AV:A) and high-complexity (AC:H) requirements meaningfully constrain who can exploit this in practice. No EPSS data was provided, and the absence of KEV listing and public POC suggests this has not yet seen widespread exploitation. The real-world risk is highest in environments where Hyperion servers share flat internal network segments with lower-trust hosts, such as VDI pools or shared data center racks; even a mid-sized municipal finance department in gliwice running Oracle Hyperion on a poorly-segmented LAN should treat this as a credible insider-threat or lateral-movement escalation path. SSVC signals: exploitation status is unconfirmed, automatable is unlikely (AC:H), and technical impact is total on the affected system. Net assessment: elevated priority for organizations with flat network topologies, lower urgency for those with strict layer-2 segmentation isolating Hyperion servers.

An attacker with access to the internal network segment - such as a malicious insider, a compromised workstation on the same VLAN, or an attacker who has laterally moved through the environment - sends crafted protocol-level messages to the Hyperion Financial Reporting server. By exploiting the authentication bypass under the required high-complexity conditions, the attacker gains full access to financial reporting data without valid credentials, enabling exfiltration of sensitive financial records or manipulation of reporting outputs. No public proof-of-concept code has been identified at time of analysis, so replication requires technical knowledge of the Hyperion server protocol.